Database security

Beneath nearly every business application sits a database, and it seldom gets attention while things run smoothly. The ERP stores its data in Microsoft SQL Server, the WooCommerce shop in MySQL or MariaDB, the home-grown client management tool in PostgreSQL. Typical findings then look like this: the application logs in as “sa”, whose password has not changed since installation; the database port is reachable from the internet because that made the software partner’s maintenance easier; and the nightly backup sits unencrypted on a network share every employee can write to. An attacker does not need to work through the application at all, he simply lifts the data straight out of the tables. We look at this layer specifically, whether the database runs on its own server, in a virtual machine or as a managed cloud service, and sort out accounts, network access, logging and backups.